YPYogeshwar Peelainexploitnotes.hashnode.dev·Sep 1 · 6 min readWebVersePro : SnowedOut writeup1. Overview The target is "Pinehollow Plow Tracker," a fictional city snow-plow dashboard running on PHP 8.2.33 behind Cloudflare. The page accepts a zone GET parameter that "centers" the map on a nam00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 23 · 18 min readBrunnerCTF 2026 : The Three Ways WriteupSummary Two connected challenges built around the same Gitea/Drone/rollout-agent environment. The first stage (Flow) gets code execution on the Drone CI runner. The second stage (Feedback / Continuous00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 23 · 6 min readBrunnerCTF 2026 : Magic or Not WriteupSummary The challenge provides four files (Brunner1.jpg, Brunner2.gif, Brunner3.png, Brunner4.bmp) that all report as generic data under file - none of them start with the magic bytes their extension 00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 23 · 13 min readBrunnerCTF 2026 : Half Baked WriteupSummary half_baked.py defines a BrunsvigerCake model with six nn.Linear layers, each with real pretrained weights and biases already assigned, but forward() just returns the input untouched - none of 00
UBUday Bhaleinhackwithrudraub.hashnode.dev·Aug 17 · 7 min readPart 3: From Admin Panel to Remote Code ExecutionWe made it. After chaining IDOR → Information Disclosure → Weak Password Reset → Administrator Access, we finally reached the admin dashboard. But administrator access isn't the end of the attack. It'00
DIDaniel Isaac Eindanielisaace.hashnode.dev·Aug 15 · 9 min readThe Endpoint Wasn't Vulnerable. The Attack Chain Was.Introduction The first finding wasn't critical. It wasn't even particularly interesting. There was no SQL Injection. No Remote Code Execution. No authentication bypass. Just an API endpoint that shoul10
ZZeroProtocolinwebpentestingdeepdive.hashnode.dev·Aug 13 · 7 min readCommon Web Application TechnologiesIntroduction Modern web applications are rarely built with a single technology. A typical application combines a web server, a programming language, a framework, a database, data formats, and backend 10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 10 · 35 min readTryHackMe : Overflow The Jackpot writeup# Challenge Category Flag 1 B1t Recovery Crypto THM{[REDACTED]} 2 Lost Fortune Included Web THM{REDACTED} 3 Casino Heist Forensics THM{REDACTED} 4 Fresh Powder - Bonus Challenge Detection Eng10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 11 · 18 min readTryHackMe : The London Bridge writeupSummary The London Bridge is built around a Flask "Explore London" gallery app served behind Gunicorn. A hidden /view_image endpoint takes a form-encoded URL and fetches it server-side - classic SSRF 11N
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 4 · 7 min readTryHackMe : CryptoCabana WriteupOverview CryptoCabana is a fake crypto-backup service hosted as an Azure Static Website. The attack path chains together four separate misconfigurations: A low-privilege Azure user with only Reader o10
